14d9c2d2a3846eaf856f7dc378df8a587f10f2702c36e00b90e92e5ac570e17f

Resubmissions

28/04/2026, 01:52

260428-calpescv518

28/04/2026, 01:41

28/04/2026, 01:37

28/04/2026, 01:32

28/04/2026, 01:28

28/04/2026, 01:22

28/04/2026, 01:12

Sharing

Copy URL Twitter E-mail

General

Target
gi9trtiw0n0whtld.exe
Size 671KB
Sample260428-calpescv51
SHA256 14d9c2d2a3846eaf856f7dc378df8a587f10f2702c36e00b90e92e5ac570e17f
MD5 9bd5d9a4e09ec3cc6ea55e6600e947b2
SHA1 3580723355ada3145e12a4efc5f9f6346b536639
SHA512 97f0b520f4dc8b1e221c7c2524293517065455d1d443976bb2d6bd19f0f10d7a7a407b6b93761bdad2be045b130949b18159a91f30f0ebe1c6c67ce6da3b05d0
SSDEEP 12288:vg1vyh0EGwp3I+q/Vrh4iV7kSnx8PMrSKfWDfpofv3wl6vXbXPH+:I1vs0Q4lUi6Snx8WSKfWDfpofvWO7H
TLSH
T10CE407042FE79E10E244267D801FD30487718BE19383774B371AF6B4696A6EE8F4E5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  gi9trtiw0n0whtld.exe
- Size 671KB
- SHA256 14d9c2d2a3846eaf856f7dc378df8a587f10f2702c36e00b90e92e5ac570e17f
- MD5 9bd5d9a4e09ec3cc6ea55e6600e947b2
- SHA1 3580723355ada3145e12a4efc5f9f6346b536639
- SHA512 97f0b520f4dc8b1e221c7c2524293517065455d1d443976bb2d6bd19f0f10d7a7a407b6b93761bdad2be045b130949b18159a91f30f0ebe1c6c67ce6da3b05d0
- SSDEEP 12288:vg1vyh0EGwp3I+q/Vrh4iV7kSnx8PMrSKfWDfpofv3wl6vXbXPH+:I1vs0Q4lUi6Snx8WSKfWDfpofvWO7H
- TLSH
  T10CE407042FE79E10E244267D801FD30487718BE19383774B371AF6B4696A6EE8F4E5E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution persistence ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Disables Task Manager via registry modification

Drops startup file

Executes dropped EXE

Adds Run key to start application

Command and Scripting Interpreter: PowerShell

Drops file in System32 directory

Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2